CVE-2026-89784

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6

rpcb_register_inet4() and rpcb_register_inet6() store the result of

rpc_sockaddr2uaddr() into map->r_addr without checking it for NULL.

rpc_sockaddr2uaddr() returns NULL when its final kstrdup() fails, and

the unchecked NULL is then carried into the synchronous RPCBPROC_SET

encode path: rpcb_register_call() -> rpc_call_sync() ->

rpcb_enc_getaddr() -> encode_rpcb_string(), whose first statement is

strlen(string), dereferencing NULL and oopsing the kernel.

The crash reproduces under failslab on v6.12; with KASAN the NULL

dereference surfaces as a fault on the shadow of address zero:

Oops: general protection fault, probably for non-canonical address

0xdffffc0000000000 [#1] PREEMPT SMP KASAN

RIP: 0010:strlen (lib/string.c:409)

Call Trace:

encode_rpcb_string (net/sunrpc/rpcb_clnt.c:890)

rpcb_enc_getaddr (net/sunrpc/rpcb_clnt.c:910)

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References